- How do I install rappasoft/lockout in a Laravel application?
- Install the package with Composer using composer require rappasoft/lockout. Publish the package configuration if your setup requires it, then register the lockout middleware in your authentication flow. Set your failed-attempt threshold and lockout duration in the config file before testing the login path.
- How do I configure the maximum failed login attempts and lockout duration?
- The package provides a simple configuration file for tuning lockout behavior per project. Set the maximum number of failed attempts and the lockout window in that config, then clear or rebuild cached configuration in deployed environments. Keep the values aligned with your security policy and user support process.
- Which Laravel and PHP versions does rappasoft/lockout support?
- The package is designed for Laravel applications using the framework's native authentication and validation flow. Exact Laravel and PHP version constraints should be checked in the package composer.json and Packagist metadata before upgrading. The provided overview does not pin specific version numbers, so verify compatibility against your application's framework version.
- How does the middleware block currently locked-out users?
- The included middleware checks whether the authenticated or attempted account is currently within a lockout window. If the account is locked, the request is blocked until the configured duration expires. Register it on the routes where you want lockout enforcement, especially login and other sensitive authentication endpoints.
- Does it work with Laravel Breeze, Jetstream, Fortify, or a custom login controller?
- It is intended to integrate cleanly with Laravel's built-in auth scaffolding and works alongside native authentication and validation. For custom login controllers, you may need to ensure failed attempts are recorded and the lockout middleware is applied to the relevant routes. Test your specific auth flow because starter kits can customize login behavior.
- What events does Laravel Lockout fire and how can I use them?
- The package fires events when a lockout occurs, allowing you to add notifications, logging, or security monitoring. Register listeners to alert administrators, write audit records, or feed failed-login activity into your observability stack. Keep event handling lightweight so a lockout does not slow the authentication response.
- How should I test account lockout behavior in Laravel?
- Use Laravel's HTTP testing helpers to submit invalid credentials repeatedly and assert that the account becomes locked and remains blocked for the configured window. Set a low threshold in test configuration, assert the lockout event is dispatched, and reset config or state between tests. Also test successful logins before the threshold and after the lockout expires.
- Is this package enough for production brute-force protection?
- It adds useful application-level account lockout protection, but it should complement other controls such as rate limiting, MFA, strong password policy, monitoring, and edge or WAF protections. Validate the lockout window and threshold against real user behavior to avoid locking out legitimate users. Test the full login and unlock flow in staging before production rollout.
- What are alternatives to rappasoft/lockout for Laravel login protection?
- Alternatives include Laravel's built-in rate limiting and ThrottleRequests middleware, Fortify's authentication features, custom failed-login tracking, or edge/WAF rate limiting. This package is focused on configurable account lockout with middleware and events. You can combine it with framework rate limiting rather than treating it as a replacement.
- How do I evaluate maintenance and upgrades for this package?
- Check the GitHub repository and Packagist release history for recent commits, supported Laravel constraints, and open issues before relying on it. Pin a known version in composer.json and test upgrades in staging against your login flow. Since the provided overview does not include a support policy, confirm maintainer responsiveness yourself for critical authentication controls.